VNX-549: Missing Password Field Masking

Detects password fields that display what is typed: <input>, Blazor InputText and MUI TextField elements for a password with type text or no type, ASP.NET Html.TextBoxFor, Rails text_field, Django CharField without PasswordInput, WTForms StringField, and Android EditText with inputType text.

Field	Value
Rule ID	`VNX-549`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Any file
CWE	CWE-549
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`password-masking` `cwe-549`
Source	`internal/sast/rules/vnx-549.rego`

Overview

VNX-549 maps to CWE-549: Missing Password Field Masking. A password typed into an unmasked field can be read by anyone looking at the screen, a screen share, a recording or a screenshot. The rule reports:

an HTML, JSX or template <input>, Blazor <InputText> or Material UI <TextField> (on one line or spread over several, attribute values quoted or not) whose name, id, formControlName, v-model, ng-model, @bind-Value or autocomplete names a password (password, passwd, pwd, passphrase, current-password, new-password) and whose type is text or absent;
a Rails f.text_field :password or text_field_tag :password, and an ASP.NET MVC Html.TextBoxFor(m => m.Password);
a Django forms.CharField for a password field without a PasswordInput widget, and a WTForms StringField/TextField for one;
an Android layout EditText whose id or hint names a password with android:inputType="text" or "textVisiblePassword".

What Gets Flagged

<input type="text" name="password" id="password">   <!-- FLAGGED -->
<input name="new_password" required minlength="12"> <!-- FLAGGED: no type means text -->

class LoginForm(forms.Form):
    password = forms.CharField(max_length=128)   # FLAGGED

What Is Not Flagged

type="password", hidden inputs, and a type bound at run time for a show-password toggle (:type="show ? 'text' : 'password'", type={visible ? 'text' : 'password'}).
password_field, PasswordField, PasswordInput, inputType="textPassword", and Django model fields.
Fields that only mention passwords (password_hint, password_strength, password_reset_token), labels, placeholders, HTML comments and test files.

Remediation

Use the masked control: type="password", f.password_field, forms.CharField(widget=forms.PasswordInput), PasswordField, android:inputType="textPassword". Offer an explicit show-password toggle if users need to check what they typed.

References

CWE-549: Missing Password Field Masking

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-549
// nosec vnx-549

Or record an ignore rule: vulnetix ignore add --rule vnx-549 --reason "...". See Suppressing findings.